@humanbased/crosscheck 1.2.0 → 1.3.0-beta.81

package/dist/skills/catalog.js

@@ -0,0 +1,104 @@
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { fileURLToPath } from 'url';
+import { homedir } from 'os';
+import yaml from 'js-yaml';
+import { computeSkillIntegrity } from './integrity.js';
+export const RECOMMENDED_SKILL_NAMES = ['code-review-skill', 'codebase-design', 'diagnosing-bugs'];
+export const BUNDLED_SKILL_RECOMMENDATIONS = {
+    'code-review': 'Best for evidence-rich repositories with documented standards and a clear issue or PRD; checks Standards and Spec separately.',
+    'code-review-skill': 'Best general default for broad language, correctness, security, performance, and architecture coverage.',
+    'codebase-design': 'Best for architecture-heavy changes: deep modules, small interfaces, clean seams, and testability.',
+    'diagnosing-bugs': 'Best for hard bugs and regressions: requires a reproducible signal, ranked hypotheses, and regression evidence.',
+};
+const COMPETING_SKILLS = {
+    'code-review': ['code-review-skill'],
+    'code-review-skill': ['code-review'],
+};
+export function findCompetingSkill(skillName, selectedNames) {
+    return COMPETING_SKILLS[skillName]?.find(name => selectedNames.includes(name));
+}
+const BUNDLED_SKILLS_DIR = fileURLToPath(new URL('../../assets/skills/', import.meta.url));
+export const INSTALLED_SKILLS_DIR = join(homedir(), '.crosscheck', 'skills');
+export function readSkillFrontmatter(skillPath) {
+    const content = readFileSync(join(skillPath, 'SKILL.md'), 'utf8');
+    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
+    if (!match)
+        return {};
+    const parsed = yaml.load(match[1]);
+    return typeof parsed === 'object' && parsed !== null ? parsed : {};
+}
+export function isValidSkillAuthor(value) {
+    return typeof value === 'string' && /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(value);
+}
+export function isValidSkillLicense(value) {
+    return typeof value === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9.+() -]{0,99}$/.test(value);
+}
+function isSkillReceipt(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const receipt = value;
+    return receipt.schemaVersion === 1
+        && typeof receipt.name === 'string' && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(receipt.name)
+        && isValidSkillAuthor(receipt.author)
+        && isValidSkillLicense(receipt.license)
+        && typeof receipt.source === 'string' && receipt.source.length > 0
+        && typeof receipt.revision === 'string' && receipt.revision.length > 0
+        && typeof receipt.integrity === 'string' && /^sha256:[0-9a-f]{64}$/.test(receipt.integrity);
+}
+function loadSkills(rootDir, skipInvalid) {
+    if (!existsSync(rootDir))
+        return [];
+    return readdirSync(rootDir, { withFileTypes: true })
+        .filter(entry => entry.isDirectory() && !entry.name.startsWith('.'))
+        .flatMap(entry => {
+        const path = join(rootDir, entry.name);
+        try {
+            const receiptPath = join(path, '.crosscheck-skill.json');
+            if (statSync(receiptPath).size > 64 * 1024)
+                throw new Error(`Invalid skill receipt: ${entry.name}`);
+            const integrity = computeSkillIntegrity(path);
+            const receipt = JSON.parse(readFileSync(receiptPath, 'utf8'));
+            const frontmatter = readSkillFrontmatter(path);
+            if (!isSkillReceipt(receipt) || receipt.name !== entry.name || frontmatter.name !== receipt.name
+                || typeof frontmatter.description !== 'string' || !frontmatter.description.trim()
+                || integrity !== receipt.integrity) {
+                throw new Error(`Invalid skill package: ${entry.name}`);
+            }
+            return [{
+                    name: receipt.name,
+                    description: frontmatter.description.trim(),
+                    author: receipt.author,
+                    license: receipt.license,
+                    source: receipt.source,
+                    revision: receipt.revision,
+                    integrity: receipt.integrity,
+                    path,
+                }];
+        }
+        catch (err) {
+            if (skipInvalid)
+                return [];
+            throw err;
+        }
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+export function loadBundledSkills(rootDir = BUNDLED_SKILLS_DIR) {
+    return loadSkills(rootDir, false);
+}
+export function loadInstalledSkills(rootDir = INSTALLED_SKILLS_DIR) {
+    return loadSkills(rootDir, true);
+}
+export function loadSkillCatalog(installedRoot = INSTALLED_SKILLS_DIR) {
+    const skills = new Map(loadBundledSkills().map(skill => [skill.name, skill]));
+    for (const skill of loadInstalledSkills(installedRoot)) {
+        if (!skills.has(skill.name))
+            skills.set(skill.name, skill);
+    }
+    return [...skills.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+export function formatSkillIdentity(skill) {
+    return `${skill.name} (by @${skill.author}, ${skill.license})`;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/skills/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/skills/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,IAAI,MAAM,SAAS,CAAA;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAwBtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,CAAU,CAAA;AAE3G,MAAM,CAAC,MAAM,6BAA6B,GAAqC;IAC7E,aAAa,EAAE,+HAA+H;IAC9I,mBAAmB,EAAE,yGAAyG;IAC9H,iBAAiB,EAAE,oGAAoG;IACvH,iBAAiB,EAAE,iHAAiH;CACrI,CAAA;AAED,MAAM,gBAAgB,GAAgD;IACpE,aAAa,EAAE,CAAC,mBAAmB,CAAC;IACpC,mBAAmB,EAAE,CAAC,aAAa,CAAC;CACrC,CAAA;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,aAAgC;IACpF,OAAO,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;AAE5E,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAA0B,CAAC,CAAC,CAAC,EAAE,CAAA;AACxF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,OAAO,OAAO,CAAC,aAAa,KAAK,CAAC;WAC7B,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;WACnF,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC;WAClC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC;WACpC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;WAC/D,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WACnE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AAC/F,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,WAAoB;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACnE,OAAO,CAAC,KAAK,CAAC,EAAE;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;YACxD,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YACnG,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;YACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;mBAC3F,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;mBAC9E,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YACzD,CAAC;YACD,OAAO,CAAC;oBACN,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;oBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,IAAI;iBACL,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,WAAW;gBAAE,OAAO,EAAE,CAAA;YAC1B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAAG,kBAAkB;IAC5D,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAO,GAAG,oBAAoB;IAChE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAAa,GAAG,oBAAoB;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7E,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAyD;IAC3F,OAAO,GAAG,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,GAAG,CAAA;AAChE,CAAC"}

package/dist/skills/installer.d.ts

@@ -0,0 +1,10 @@
+import { type SkillIdentity } from './catalog.js';
+export { computeSkillIntegrity } from './integrity.js';
+export interface InstallSkillOptions {
+    installDir?: string;
+}
+export declare class SkillInstallError extends Error {
+}
+export declare function redactSkillSource(source: string): string;
+export declare function installSkill(source: string, opts?: InstallSkillOptions): Promise<SkillIdentity>;
+//# sourceMappingURL=installer.d.ts.map

package/dist/skills/installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/skills/installer.ts"],"names":[],"mappings":"AAIA,OAAO,EAA+H,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAG9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYxD;AAuCD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAgEzG"}

package/dist/skills/installer.js

@@ -0,0 +1,138 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'fs';
+import { basename, join, resolve } from 'path';
+import { tmpdir } from 'os';
+import { execa } from 'execa';
+import { INSTALLED_SKILLS_DIR, isValidSkillAuthor, isValidSkillLicense, loadBundledSkills, loadInstalledSkills, readSkillFrontmatter } from './catalog.js';
+import { computeSkillIntegrity } from './integrity.js';
+export { computeSkillIntegrity } from './integrity.js';
+export class SkillInstallError extends Error {
+}
+export function redactSkillSource(source) {
+    if (existsSync(source))
+        return resolve(source);
+    try {
+        const url = new URL(source);
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        return url.toString();
+    }
+    catch {
+        return source;
+    }
+}
+function detectLicense(rootDir, declared) {
+    if (typeof declared === 'string' && declared.trim())
+        return declared.trim();
+    const licenseName = ['LICENSE', 'LICENSE.md', 'COPYING'].find(name => existsSync(join(rootDir, name)));
+    if (!licenseName)
+        return 'UNKNOWN';
+    const license = readFileSync(join(rootDir, licenseName), 'utf8');
+    if (/MIT License/i.test(license))
+        return 'MIT';
+    if (/Apache License[\s\S]*Version 2\.0/i.test(license))
+        return 'Apache-2.0';
+    if (/BSD 3-Clause/i.test(license))
+        return 'BSD-3-Clause';
+    if (/ISC License/i.test(license))
+        return 'ISC';
+    return 'UNKNOWN';
+}
+function detectAuthor(source, declared) {
+    if (typeof declared === 'string' && declared.trim())
+        return declared.trim().replace(/^@/, '');
+    return /github\.com[/:]([^/]+)/i.exec(source)?.[1] ?? 'local';
+}
+async function checkoutSource(source) {
+    if (existsSync(source)) {
+        const path = resolve(source);
+        if (lstatSync(path).isSymbolicLink())
+            throw new SkillInstallError('Skill source cannot be a symbolic link');
+        if (!statSync(path).isDirectory())
+            throw new SkillInstallError(`Skill source is not a directory: ${source}`);
+        return { path, revision: 'local' };
+    }
+    const cleanup = mkdtempSync(join(tmpdir(), 'crosscheck-skill-clone-'));
+    const path = join(cleanup, 'source');
+    try {
+        await execa('git', ['clone', '--depth', '1', source, path]);
+        const revision = (await execa('git', ['-C', path, 'rev-parse', 'HEAD'])).stdout.trim();
+        return { path, revision, cleanup };
+    }
+    catch (err) {
+        rmSync(cleanup, { recursive: true, force: true });
+        throw new SkillInstallError(`Could not clone skill source: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export async function installSkill(source, opts = {}) {
+    const installDir = resolve(opts.installDir ?? INSTALLED_SKILLS_DIR);
+    const checkout = await checkoutSource(source);
+    try {
+        if (!existsSync(join(checkout.path, 'SKILL.md'))) {
+            throw new SkillInstallError('Skill package must contain SKILL.md');
+        }
+        try {
+            computeSkillIntegrity(checkout.path);
+        }
+        catch (err) {
+            throw new SkillInstallError(err instanceof Error ? err.message : String(err));
+        }
+        let frontmatter;
+        try {
+            frontmatter = readSkillFrontmatter(checkout.path);
+        }
+        catch (err) {
+            throw new SkillInstallError(`Invalid SKILL.md frontmatter: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const name = typeof frontmatter.name === 'string' ? frontmatter.name : '';
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) {
+            throw new SkillInstallError(`Invalid skill name: ${name || '(missing)'}`);
+        }
+        if (typeof frontmatter.description !== 'string' || !frontmatter.description.trim()) {
+            throw new SkillInstallError('Skill frontmatter must include a description');
+        }
+        if (loadBundledSkills().some(skill => skill.name === name)) {
+            throw new SkillInstallError(`Skill ${name} is already bundled with Crosscheck`);
+        }
+        mkdirSync(installDir, { recursive: true });
+        const target = join(installDir, name);
+        if (existsSync(target)) {
+            throw new SkillInstallError(`Skill ${name} is already installed`);
+        }
+        const pendingTarget = join(installDir, `.install-${name}-${process.pid}`);
+        try {
+            cpSync(checkout.path, pendingTarget, {
+                recursive: true,
+                filter: path => basename(path) !== '.git' && basename(path) !== '.crosscheck-skill.json',
+            });
+            const author = detectAuthor(source, frontmatter.author);
+            const license = detectLicense(checkout.path, frontmatter.license);
+            if (!isValidSkillAuthor(author))
+                throw new SkillInstallError(`Invalid skill author: ${author}`);
+            if (!isValidSkillLicense(license))
+                throw new SkillInstallError(`Invalid skill license: ${license}`);
+            const receipt = {
+                schemaVersion: 1,
+                name,
+                author,
+                license,
+                source: redactSkillSource(source),
+                revision: checkout.revision,
+                integrity: computeSkillIntegrity(pendingTarget),
+            };
+            writeFileSync(join(pendingTarget, '.crosscheck-skill.json'), `${JSON.stringify(receipt, null, 2)}\n`);
+            renameSync(pendingTarget, target);
+            return loadInstalledSkills(installDir).find(skill => skill.name === name);
+        }
+        catch (err) {
+            rmSync(pendingTarget, { recursive: true, force: true });
+            throw err;
+        }
+    }
+    finally {
+        if (checkout.cleanup)
+            rmSync(checkout.cleanup, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=installer.js.map

package/dist/skills/installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/skills/installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AACrI,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,oBAAoB,EAAsB,MAAM,cAAc,CAAA;AAC9K,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAMtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC3B,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAA;QACjB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAA;QACf,GAAG,CAAC,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,QAAkB;IACxD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC3E,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACtG,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAA;IAClC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;IAChE,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAA;IAC3E,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,cAAc,CAAA;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,QAAkB;IACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7F,OAAO,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc;IAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAA;QAC3G,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAA;QAC5G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjD,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAA4B,EAAE;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC,CAAA;IACnE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC;YACH,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,WAAW,CAAA;QACf,IAAI,CAAC;YACH,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,MAAM,IAAI,iBAAiB,CAAC,8CAA8C,CAAC,CAAA;QAC7E,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CAAC,SAAS,IAAI,qCAAqC,CAAC,CAAA;QACjF,CAAC;QAED,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACrC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QAEzE,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE;gBACnC,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,wBAAwB;aACzF,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;YACvD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;YACjE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;YAC/F,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;YACnG,MAAM,OAAO,GAAG;gBACd,aAAa,EAAE,CAAC;gBAChB,IAAI;gBACJ,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC;gBACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qBAAqB,CAAC,aAAa,CAAC;aAChD,CAAA;YACD,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;YACrG,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;YACjC,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAE,CAAA;QAC5E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ,CAAC,OAAO;YAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClF,CAAC;AACH,CAAC"}

package/dist/skills/integrity.d.ts

@@ -0,0 +1,4 @@
+export declare const MAX_SKILL_PACKAGE_FILES = 1000;
+export declare const MAX_SKILL_PACKAGE_BYTES: number;
+export declare function computeSkillIntegrity(rootDir: string): string;
+//# sourceMappingURL=integrity.d.ts.map

package/dist/skills/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../../src/skills/integrity.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAC5C,eAAO,MAAM,uBAAuB,QAAmB,CAAA;AAevD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc7D"}

package/dist/skills/integrity.js

@@ -0,0 +1,36 @@
+import { createHash } from 'crypto';
+import { lstatSync, readFileSync, readdirSync, statSync } from 'fs';
+import { join, relative, sep } from 'path';
+export const MAX_SKILL_PACKAGE_FILES = 1_000;
+export const MAX_SKILL_PACKAGE_BYTES = 10 * 1024 * 1024;
+function packageFiles(rootDir, currentDir, files) {
+    for (const entry of readdirSync(currentDir, { withFileTypes: true })) {
+        if (entry.name === '.git' || entry.name === '.crosscheck-skill.json')
+            continue;
+        const path = join(currentDir, entry.name);
+        if (lstatSync(path).isSymbolicLink())
+            throw new Error('Skill packages cannot contain symbolic links');
+        if (entry.isDirectory())
+            packageFiles(rootDir, path, files);
+        else if (entry.isFile()) {
+            files.push(path);
+            if (files.length > MAX_SKILL_PACKAGE_FILES)
+                throw new Error(`Skill packages cannot contain more than ${MAX_SKILL_PACKAGE_FILES} files`);
+        }
+    }
+}
+export function computeSkillIntegrity(rootDir) {
+    const files = [];
+    packageFiles(rootDir, rootDir, files);
+    files.sort((a, b) => relative(rootDir, a).localeCompare(relative(rootDir, b)));
+    const totalBytes = files.reduce((sum, path) => sum + statSync(path).size, 0);
+    if (totalBytes > MAX_SKILL_PACKAGE_BYTES)
+        throw new Error('Skill packages cannot exceed 10 MiB');
+    const hash = createHash('sha256');
+    for (const path of files) {
+        hash.update(relative(rootDir, path).split(sep).join('/')).update('\0');
+        hash.update(readFileSync(path)).update('\0');
+    }
+    return `sha256:${hash.digest('hex')}`;
+}
+//# sourceMappingURL=integrity.js.map

package/dist/skills/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/skills/integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAE1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAA;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEvD,SAAS,YAAY,CAAC,OAAe,EAAE,UAAkB,EAAE,KAAe;IACxE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB;YAAE,SAAQ;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACrG,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;aACtD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChB,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,uBAAuB,QAAQ,CAAC,CAAA;QACzI,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE9E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC5E,IAAI,UAAU,GAAG,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAEhG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACvC,CAAC"}